Clark, Hunt, AhernlEmbry 

ATTORNEYS AT LAW VX 


BRUCE J. EMBRY 
WILLIAM J. HUNT 
WILLIAM F. AHERN, JR, 
HENRY W. CLARK 
DAVID GRAY HANSON 
DIANE SWIERCZYNSKE 
JOSHUA D. KRELL 
JANINE BROWN-SMITH 



U-'j 3 


OFFICE OF CONSUMER AFFAIRS 

--— ■ &igust u, 2010 


MARISA S. GREGG 
JEREMY Y. WELTMAN 
KATHARINE M. FELLUCA 
MICHAEL J. ROSSI 

COREY H. SURETY, OF COUNSEL 
MARTHA B.G. LUFKIN, OF COUNSEL 


Barbara Anthony, Esquire, Undersecretary 

Office of the Consumer Affairs and Business Regulation 

Ten Park Plaza, Suite 5170 

Boston, MA 02116 

Re: REPORT PURSUANT TO MASS.GEN.L.CH.93H 

Dear Undersecretary Anthony: 

Pursuant to Mass. Gen. L. eh. 93H, this letter is to notify you of a breach of 
security involving the Personal Information (as defined in the statute) of 
Massachusetts residents. 

NATURE OF THE SECURITY BREACH 

On July 30, 2010, while an of counsel attorney who performs services for our 
clients was away from her locked residence in Lincoln, Massachusetts, the residence was 
broken into, and among other items, two laptop computers and a thumb drive were 
stolen. Among the information on those computers were the Personal Information of 9 
Massachusetts residents who are our clients or related names. The attorney had such 
Personal Information in connection with her performance of legal services for us (in part 
out of her house) with a specialty in estate planning and administration. 

NUMBER OF MASSACHUSETTS RESIDENTS AFFECTED 

After a thorough review of available copies of the records on the computer 
hard drive, the attorney has determined that the Personal Information of 9 
Massachusetts residents used in connection with services performed for this firm 
was involved. In addition, the personal information of 2 non-residents was 
involved. 

STEPS TAKEN RELATING TO THE INCIDENT 

The attorney has already taken the following steps in response to this incident: 

• Report to Lincoln, MA Police; 

• Engagement of outside counsel; 

• Notification to us; 
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• Adoption and continuing improvement of hands-on security features in 
accordance with 201 CMR 17 to protect all personal information used for 
her work for us including information on computers (all on encrypted or 
non-portable devices), to be reviewed in conjunction with development and 
implementation of a WISP for her law practice; 

• Arranging for one year of free credit monitoring services for all affected 
persons described in this letter, including residents and non-residents 
(at the attorney’s cost). 

We will send each affected Massachusetts resident (and non-residents) a 
notification, as required by Mass. Gen. L. ch. 93H, substantially in the form attached. 

We are working on, or plan to take, the following steps in response to this 
incident: 


• Improvement of our WISP implementation program to better educate attorneys, 
employees and others and to improve safeguarding of personal information in 
accordance with 201 CMR 17; 

• Working to improve hands-on procedures to better protect personal information 
used by attorneys, employees and others in accordance with 201 CMR 17. 


OTHER NOTIFICATIONS 

In addition to the notifications to consumers noted above, I am simultaneously 
sending a similar notification letter to Attorney General Martha Coakley, Office of the 
Massachusetts Attorney General. 

CONTACT INFORMATION 

If you have any questions about this matter, please contact me. My contact 
information: 


William J. Hunt, Clark, Hunt, Ahem & Embry, 55 Cambridge Parkway, Cambridge, 
MA 02142; Tel: (617) 494-1920 Email: whunt@chelaw.com. 


l\ 


Sincerely, 


lo— VlW 




William! jj Hunt 


Enclosure: Letter to Massachusetts Residents 


cc: David A. Murray, Esq. 

General Counsel, MA Office of Office of Consumer Affairs and Business 
Regulation 
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Sample letter to affected person 


August 2010 

AFFECTED PERSON’S address 

IMPORTANT NOTICE REGARDING 
YOUR PERSONAL INFORMATION 


Dear 


The Incident 

This is to notify you that a breach of security that involved your personal information occurred on 
July 30, 2010. 

We have no indication that your personal information has been misused, but we are writing to let 
you know about your rights under the circumstances and some steps you can take to try to prevent 
any identity theft. 

Your Right to Police Reports 

Under Massachusetts law, you have the right to obtain any police report filed in connection with 
this incident. If you are the victim of identity theft, you also have the right to file a police report 
and obtain a copy of it. 

Your Right to a Credit Security Freeze 

Massachusetts law also allows consumers to place a security freeze on their - credit reports. A 
security freeze prohibits a credit reporting agency from releasing any information from a 
consumer’s credit report without written authorization. Flowever, please be aware that placing a 
security freeze on your credit report may delay, interfere with, or prevent the timely approval of 
any requests you make for new loans, credit mortgages, employment, housing or other services. 

If you have been a victim of identity theft, and you provide the credit reporting agency with a valid 
police report, it cannot charge you to place, lift or remove a security freeze. In all other cases, a 
credit reporting agency may charge you up to $5.00 to place, temporarily lift, or permanently 
remove a security freeze. 


55 Cambridge Parkway > Cambridge, Massachusetts 02142 • 617-494-1920 . fax 617-494-1921 • www.chetaw.com 




Clark, Hunt, Ahern-; ,Embry 

ATTORNEYS AT LAW OC 

To place a security freeze on your credit report, you must send a written request to each of the three 
major consumer reporting agencies; Equifax (www.equifax.com); Experian (www.experian.com); 
and TransUnion (www.transunion.com) by regular, certified or overnight mail at the addresses 
below: 


Equifax Security Freeze 
P.O.Box 105788 
Atlanta, GA 30348 

Experian Security Freeze 
P.O.Box 9554 
Allen, TX 75013 


Trans Union Security Freeze 

Fraud Victim Assistance Department P.O. Box 6790 

Fullerton, CA 92834 

In order to request a security freeze, you will need to provide the following information; 

1 . Your full name (including middle initial as well as Jr., Sr., n, HI, etc.); 

2. Social Security Number; 

3. Date of birth; 

4. If you have moved in the past five (5) years, provide the addresses where you have lived 

over the prior five years; 

5. Proof of current address such as a current utility bill or telephone bill; 

6. A legible photocopy of a government issued identification card (state driver’s license or ID 

card, military identification, etc.) 

7. If you are a victim of identity theft, include a copy of either the police report, investigative 

report, or complaint to a law enforcement agency concerning identity theft; 

8. If you are not a victim of identity theft, include payment by check, money order, or credit 

card (Visa, MasterCard, American Express or Discover only). Do not send cash 
through the mail. 

The credit reporting agencies have three (3) business days after receiving your request to place a 
security freeze on your credit report. The credit bureaus must also send written confirmation to 
you within five (5) business days and provide you with a unique personal identification number 
(PIN) or password, or both that can be used by you to authorize the removal or lifting of the 
security freeze. 

To lift the security freeze in order to allow a specific entity or individual access to your credit 
report, you must call or send a written request to the credit reporting agencies by mail and include 
proper identification (name, address, and social security number) and the PIN number or password 
provided to you when you placed the security freeze as well as the identities of those entities or 
individuals you would like to receive your credit report or the specific period of time you want the 
credit report available. The credit reporting agencies have three (3) business days after receiving 
your request to lift the security freeze for those identified entities or for the specified period of time. 

To remove the security freeze, you must send a written request to each of the three credit bureaus 
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by mail and include proper identification (name, address, and social security number) and the PIN 
number or password provided to you when you placed the security freeze. The credit bureaus have 
three (3) business days after receiving your request to remove the security freeze. 

FREE CREDIT MONITORING SERVICES 

To enable you to detect any misuse of your information, you will be provided with a full year of 
credit monitoring at no cost to you. We will send details about how to enroll in this in a follow-up 
letter. 

For More Information 

For more information on identity theft risks and Massachusetts law, please see the Massachusetts 
Attorney General’s web site at 

http://www.mass.gov/?pageID=cagosubtopic&L=3&L0=Home&Ll : =Consumer+Protection&L2 
=S cams+and+Identit v+Theft&si d=Cago . 

You may also want to visit the Federal Trade Commission’s identity theft web site for more 
infonnation: http://www.ftc.gov/bcp/edu/microsites/idtheft/ 

We take this incident very seriously and deeply regret that it happened. We apologize for any 
inconvenience or concern it may cause you. Please be assured that we are taking numerous steps 
to avoid any recurrence. 

Please do not hesitate to contact me at (617) 494-1920 with any questions or concerns. 

Very truly yours. 


Martha B. G. Lufkin 



